layers · policies
Privacy Policy
Last updated 22 October 2026
This policy explains what personal data Clomia (“we”), the company behind layers, collects at layers.clomia.com, why, who receives it, how long we keep it, and your rights. Clomia is the controller of that data. Contact: clomia.sig@gmail.com · +82 10-7528-7237 · 11F, Room 1103, 174 Bongeunsa-ro, Gangnam-gu, Seoul, Republic of Korea.
What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Account: your Google account ID, email address and name | Google, when you sign in | To keep your orders in your account and contact you about them |
| Sign-in: a cookie holding a random token, and when it was made and expires | Your browser | To keep you signed in and protect your account |
| Your order: the brief, the videos and images you upload, your agreement to the three statements before you pay, your revision requests, and the replies of the layers AI System | You, and our software | To check, make, revise and deliver your piece, and to show what you agreed to |
| Your piece: the delivered videos and cover images | Our software | To deliver it and keep it available to you |
| Payment records: Paddle’s transaction and customer IDs, amounts, tax, currency, Paddle’s fee and refund status | Paddle | To link payments and refunds to your order. We never receive card details |
| Support messages: what you send to our email or phone | You | To answer you |
Your materials may contain personal data of other people (for example a person in a photo). You may supply it only with their consent (Terms, section 4); we process it only to make your piece. If you are such a person, this policy is our notice to you too: your rights below apply, and you can ask us to remove you.
We collect no data through advertising or tracking cookies, and we use no third-party analytics.
Legal bases (for the EU, UK and similar laws)
Performing our contract with you (account, order, delivery, revisions, payment linkage); our legitimate interests (securing the service, preventing abuse, checking orders, improving how we make pieces, and the portfolio use in Terms section 7); and legal obligations (tax, consumer and accounting records).
Who receives your data
We use service providers that process data on our behalf, under contracts that limit them to providing their service:
| Recipient (contact) | What they receive | Purpose | Country |
|---|---|---|---|
| Amazon Web Services, Inc. (aws.amazon.com/contact-us) | Everything above (storage, computing and content delivery) | Hosting the service | United States (us-east-1) and its content delivery network |
| Anthropic, PBC, through Claude Platform on AWS (privacy@anthropic.com) | Your brief, revision requests, images, and frames of your videos | Checking each order before production; the layers AI System’s work and replies | United States |
| Runway AI, Inc. (support@runwayml.com) and the video models it serves | Text prompts derived from your brief, and images or video frames from your materials | Generating video | United States |
| ElevenLabs Inc. (privacy@elevenlabs.io) | The narration script | Generating narration | United States |
| Google LLC (support.google.com) | Your sign-in | Signing you in | United States |
| Slack Technologies, LLC (privacy@slack.com) | Your brief, revision requests and the progress of your order | The team’s record of each order’s production | United States |
| Google LLC, Gmail | Messages you send our support address | Answering support | United States |
Paddle (Paddle.com Market Ltd, United Kingdom, and its affiliates) receives your payment data as a controller in its own right, as our reseller and Merchant of Record, for the sale, payment, fraud prevention, tax and invoicing. Its privacy notice governs that data: paddle.com/legal/privacy.
We also share data with professional advisers (lawyers, accountants) where needed, and with authorities only when the law requires it. We do not sell personal data.
International transfers
We are in the Republic of Korea, and the recipients above are mostly in the United States. Your data is transferred when you sign in, place an order, or contact us, over encrypted network connections, to the recipients and for the purposes listed above. Each recipient keeps it only as long as its service to us needs, and never longer than the periods below. Where the GDPR or UK GDPR applies, we rely on the recipient’s adequacy status or on standard contractual clauses.
Under Korea’s Personal Information Protection Act, these transfers are entrustment and storage needed to perform our contract with you, disclosed in this policy (Art. 28-8(1)(iii)). You may refuse them by not placing an order or by asking us to delete your data; because the service cannot run without these recipients, refusing means we cannot make your order.
How long we keep it
- Your account, orders, materials, pieces, conversations and payment records: 3 years after your latest order is complete or refunded; then deleted.
- Records that tax or consumer law requires us to keep longer are kept only for that period and that purpose.
- Sign-in data: until you sign out or the sign-in expires (30 days without use).
- Paddle keeps its own records under its own policy.
Automated decisions and AI
Software checks every order before production, and an order our software or AI providers refuse is refunded automatically. If you think a refusal was wrong, write to clomia.shorts@gmail.com and a person will review it.
We do not use your materials to train AI models. We do learn from orders to improve how the layers AI System makes pieces: notes about what worked may enter our internal method, without your personal data.
Your rights
You can ask to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent where we rely on it. Write to clomia.sig@gmail.com; we answer within 10 days, and within one month where the GDPR applies. Deleting your data while an order is in progress ends that order.
You can also complain to your data protection authority. In Korea: the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972), the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Supreme Prosecutors’ Office (www.spo.go.kr, 1301), and the Korean National Police Agency (ecrm.police.go.kr, 182).
Cookies
One sign-in cookie, set when you sign in, and a short-lived cookie that protects the Google sign-in step. No advertising, analytics or third-party cookies on our pages. Paddle’s checkout sets its own cookies under its own policy.
Security
Encryption in transit and at rest, access limited to the people and systems that need it, sign-in only through Google, and logs of administrative access.
Children
layers is not for anyone under 18, and we do not knowingly collect children’s data.
Destroying data
When the retention period ends we delete the data from our database and storage and overwrite it in backups within 30 days; files are deleted permanently and records cannot be restored.
Privacy officer (개인정보 보호책임자)
JeongHoo Won (원정후), Representative · clomia.sig@gmail.com · +82 10-7528-7237
Changes
When this policy changes we update it here with the date at the top, and we tell signed-in customers by email of material changes before they apply.